Unverified50% confidenceEventExact time
Case one, "EchoLeak": an implanted email caused Copilot to send private data to an attacker with zero clicks; the issue has been fixed on the server side, and no abuse reports have been seen.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/24/2026
First Seen
Valid until: 1/22/2027
Sources
Related Entities
Related Claims
UnverifiedWhen a project's security information relies on humans relaying it among multiple mailing lists, a single misaddressed recipient is enough to make coordinated disclosure fail.73% similarUnverifiedOnce the trigger endpoint is exposed to the public internet, without secret verification anyone can call it, potentially leading to wasted resources, spam, or even data being accidentally deleted.72% similarUnverified邮件转发中Received字段记录每一跳服务器信息，Return-Path字段存储退信地址，X-Forwarded-To等扩展头字段可能暴露真实收件人71% similarUnverifiedMany enterprises configure noreply addresses as real but unmonitored mailboxes, causing emails replied to by users to be successfully delivered and stored.71% similarUnverifiedThe exposure of username-to-email address mappings can be used for cross-platform credential stuffing attacks, particularly against users who reuse the same password.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1092661API
curl https://kongchang.com/api/v1/knowledge/claims/1092661MCP
get_claim(id=1092661)